Security and vulnerability disclosure

How to report

Email [email protected] with the subject "Security report". Please include:

• what is affected (website, dashboard, API, MQTT broker, agent and its version, apt repository);
• the steps to reproduce it, and what an attacker could do with it;
• how we can reach you, and whether you want to be credited.

What we do

• We confirm that we received your report within 3 working days.
• We tell you whether we could reproduce it, and keep you informed until it is fixed.
• We fix confirmed problems and ship agent fixes as a new release in the signed apt repository.
• We credit you in the release notes if you wish, once the fix is out.
• If a problem is actively exploited, we report it to the authorities as the law requires.

Please

• test only with your own account and your own devices;
• do not access, change or delete other people's data, and stop as soon as you reach any;
• do not degrade the service for others (no denial-of-service or load tests, no spam);
• give us reasonable time to fix a problem before you publish it.

We will not take legal action against research done in good faith within these rules.

How KinuxOTA is secured

Device keys, encrypted connections, what the agent can do and how your data is kept are described in the security documentation. Who provides KinuxOTA: legal notice.

We test it ourselves and publish the results: what is checked, how often, the last run that passed, and what was found and fixed, on the security verification page. It is our own testing with open-source tools, not an independent audit; an external penetration test is planned.